Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-12-2022 23:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    225KB

  • MD5

    f842773eeae971948df273f1b72811ef

  • SHA1

    53c32961609be41cbbaf6a7c239c28ceb7edbcad

  • SHA256

    2dac1cdea62e957d9e4652f5b2fbed2b9643ac4bd7bd63a1ca03e82d3a070cf2

  • SHA512

    600be0ea76790cc071f8be7901168acc1ae34e8251647576e141a6586a17ff132aa00b7de577e1bfc9e48d73fa6db25b28dbf9c3eb0be4a9e82b899c1ec98daf

  • SSDEEP

    3072:12YUzLDzeTo5uYvWkrc/ftfEufmSWwelixMlc6NZHCxKRXPH8oS+Ei+Y3Ox6qQo3:4LDiTlk6ftnfm1l1eKB8oJN+Hk5o

Score
10/10
amadeydcratdjvuredlinesmokeloadersocelarsinstalls3mario23_10backdoorbootkitcollectiondiscoveryevasioninfostealerpersistenceransomwareratspywarestealertrojanvmprotect

Malware Config

Extracted

Family

redline

Botnet

mario23_10

C2

167.235.252.160:10642

Attributes
  • auth_value

    eca57cfb5172f71dc45986763bb98942

Extracted

Family

djvu

C2

http://ex3mall.com/lancer/get.php

Attributes
  • extension

    .isza

  • offline_id

    m3KmScxfDyEQzJYP8qjOSfP4FvpsOXlekGuMPzt1

  • payload_url

    http://uaery.top/dl/build2.exe

    http://ex3mall.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-oWam3yYrSr Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0622JOsie

rsa_pubkey.plain

Extracted

Family

amadey

Version

3.61

C2

62.204.41.79/U7vfDb3kg/index.php

Extracted

Family

amadey

Version

3.63

C2

62.204.41.182/g9TTnd3bS/index.php

Extracted

Family

amadey

Version

3.60

C2

193.42.33.28/game0ver/index.php

Extracted

Family

redline

Botnet

Installs3

C2

89.23.96.2:7253

Attributes
  • auth_value

    fd80b5722a90ed6c0cf5ba897d0e4c4b

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/wduwe19/

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detected Djvu ransomware 10 IoCs
  • Detects Smokeloader packer 5 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 40 IoCs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 10 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 12 IoCs
  • Checks SCSI registry key(s) 3 TTPs 11 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 30 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2728
  • C:\Users\Admin\AppData\Local\Temp\D6CD.exe
    C:\Users\Admin\AppData\Local\Temp\D6CD.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:688
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 268
      2⤵
      • Program crash
      PID:3124
  • C:\Users\Admin\AppData\Local\Temp\D806.exe
    C:\Users\Admin\AppData\Local\Temp\D806.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Users\Admin\AppData\Local\Temp\D806.exe
      C:\Users\Admin\AppData\Local\Temp\D806.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\e7292bf6-0390-4308-a547-2325f5d851ca" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:4476
      • C:\Users\Admin\AppData\Local\Temp\D806.exe
        "C:\Users\Admin\AppData\Local\Temp\D806.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4696
        • C:\Users\Admin\AppData\Local\Temp\D806.exe
          "C:\Users\Admin\AppData\Local\Temp\D806.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          PID:3264
          • C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe
            "C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:1784
            • C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe
              "C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe"
              6⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Loads dropped DLL
              • Checks processor information in registry
              PID:4328
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe" & exit
                7⤵
                  PID:3488
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 6
                    8⤵
                    • Delays execution with timeout.exe
                    PID:4220
            • C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build3.exe
              "C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build3.exe"
              5⤵
              • Executes dropped EXE
              PID:1208
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                6⤵
                • Creates scheduled task(s)
                PID:3640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 452 -ip 452
      1⤵
        PID:2184
      • C:\Users\Admin\AppData\Local\Temp\DA78.exe
        C:\Users\Admin\AppData\Local\Temp\DA78.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4252
        • C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe
          "C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe"
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4480
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe" /F
            3⤵
            • Creates scheduled task(s)
            PID:4564
          • C:\Users\Admin\AppData\Local\Temp\1000050001\Legs.exe
            "C:\Users\Admin\AppData\Local\Temp\1000050001\Legs.exe"
            3⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:4288
            • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
              "C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe"
              4⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:432
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe" /F
                5⤵
                • Creates scheduled task(s)
                PID:4308
              • C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe
                "C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"
                5⤵
                • Executes dropped EXE
                PID:2884
              • C:\Users\Admin\AppData\Local\Temp\1000002001\bin.exe
                "C:\Users\Admin\AppData\Local\Temp\1000002001\bin.exe"
                5⤵
                • Executes dropped EXE
                • Checks computer location settings
                PID:4972
                • C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
                  "C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe"
                  6⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Adds Run key to start application
                  PID:3344
                  • C:\Windows\SysWOW64\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN WinComService.exe /TR "C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe" /F
                    7⤵
                    • Creates scheduled task(s)
                    PID:3164
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "WinComService.exe" /P "Admin:N"&&CACLS "WinComService.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a4e2bd6d47" /P "Admin:N"&&CACLS "..\a4e2bd6d47" /P "Admin:R" /E&&Exit
                    7⤵
                      PID:3232
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:4292
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "WinComService.exe" /P "Admin:N"
                          8⤵
                            PID:2184
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "WinComService.exe" /P "Admin:R" /E
                            8⤵
                              PID:1188
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                              8⤵
                                PID:4416
                              • C:\Windows\SysWOW64\cacls.exe
                                CACLS "..\a4e2bd6d47" /P "Admin:N"
                                8⤵
                                  PID:3124
                                • C:\Windows\SysWOW64\cacls.exe
                                  CACLS "..\a4e2bd6d47" /P "Admin:R" /E
                                  8⤵
                                    PID:1500
                                • C:\Users\Admin\AppData\Roaming\1000034050\system32.exe
                                  "C:\Users\Admin\AppData\Roaming\1000034050\system32.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:3520
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 472
                                    8⤵
                                    • Program crash
                                    PID:4832
                                • C:\Users\Admin\AppData\Roaming\1000038050\bd.exe
                                  "C:\Users\Admin\AppData\Roaming\1000038050\bd.exe"
                                  7⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Executes dropped EXE
                                  • Checks BIOS information in registry
                                  • Checks whether UAC is enabled
                                  • Writes to the Master Boot Record (MBR)
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Checks SCSI registry key(s)
                                  PID:4564
                                • C:\Users\Admin\AppData\Local\Temp\1000040001\super9.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1000040001\super9.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2240
                            • C:\Users\Admin\AppData\Local\Temp\1000003001\Livability.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000003001\Livability.exe"
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4740
                            • C:\Users\Admin\AppData\Local\Temp\1000004051\trud.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000004051\trud.exe"
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4232
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 1236
                                6⤵
                                • Program crash
                                PID:3156
                            • C:\Users\Admin\AppData\Local\Temp\1000005051\linda5.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000005051\linda5.exe"
                              5⤵
                              • Executes dropped EXE
                              • Checks computer location settings
                              PID:2356
                              • C:\Windows\SysWOW64\control.exe
                                "C:\Windows\System32\control.exe" .\xHFA.3~E
                                6⤵
                                  PID:404
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\xHFA.3~E
                                    7⤵
                                    • Loads dropped DLL
                                    PID:2176
                                    • C:\Windows\system32\RunDll32.exe
                                      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\xHFA.3~E
                                      8⤵
                                        PID:3944
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\xHFA.3~E
                                          9⤵
                                          • Loads dropped DLL
                                          PID:5008
                                • C:\Users\Admin\AppData\Local\Temp\1000006001\z1ugk979.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1000006001\z1ugk979.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:4288
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                    6⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1116
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 504
                                    6⤵
                                    • Program crash
                                    PID:4696
                                • C:\Users\Admin\AppData\Local\Temp\1000008001\csgd2.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1000008001\csgd2.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  PID:2096
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1000008001\csgd2.exe" & exit
                                    6⤵
                                      PID:5684
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 6
                                        7⤵
                                        • Delays execution with timeout.exe
                                        PID:5768
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1816
                                      6⤵
                                      • Program crash
                                      PID:5744
                                  • C:\Users\Admin\AppData\Local\Temp\1000009001\mp3studios_97.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000009001\mp3studios_97.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3744
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c taskkill /f /im chrome.exe
                                      6⤵
                                        PID:1696
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im chrome.exe
                                          7⤵
                                          • Kills process with taskkill
                                          PID:4028
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                        6⤵
                                        • Enumerates system info in registry
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:3840
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5d664f50,0x7ffa5d664f60,0x7ffa5d664f70
                                          7⤵
                                            PID:1488
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1652 /prefetch:2
                                            7⤵
                                              PID:2056
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1976 /prefetch:8
                                              7⤵
                                                PID:5068
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 /prefetch:8
                                                7⤵
                                                  PID:2592
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
                                                  7⤵
                                                    PID:4312
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
                                                    7⤵
                                                      PID:872
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
                                                      7⤵
                                                        PID:952
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
                                                        7⤵
                                                          PID:5124
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4224 /prefetch:8
                                                          7⤵
                                                            PID:5260
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4676 /prefetch:8
                                                            7⤵
                                                              PID:5352
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4960 /prefetch:8
                                                              7⤵
                                                                PID:5424
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5124 /prefetch:8
                                                                7⤵
                                                                  PID:5436
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
                                                                  7⤵
                                                                    PID:5964
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4792 /prefetch:8
                                                                    7⤵
                                                                      PID:6020
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5628 /prefetch:8
                                                                      7⤵
                                                                        PID:6052
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                                                                        7⤵
                                                                          PID:6104
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
                                                                          7⤵
                                                                            PID:704
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:8
                                                                            7⤵
                                                                              PID:5900
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5728 /prefetch:8
                                                                              7⤵
                                                                                PID:4668
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
                                                                                7⤵
                                                                                  PID:5736
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1612,7537280951919266704,14832403583350154516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4892 /prefetch:8
                                                                                  7⤵
                                                                                    PID:600
                                                                              • C:\Users\Admin\AppData\Local\Temp\1000010001\random.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1000010001\random.exe"
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Checks computer location settings
                                                                                PID:1456
                                                                                • C:\Users\Admin\AppData\Local\Temp\1000010001\random.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\1000010001\random.exe" -h
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:3336
                                                                              • C:\Users\Admin\AppData\Local\Temp\1000011001\pb1109.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1000011001\pb1109.exe"
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                PID:2344
                                                                              • C:\Users\Admin\AppData\Local\Temp\1000016001\Liva100.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1000016001\Liva100.exe"
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                PID:2360
                                                                              • C:\Users\Admin\AppData\Local\Temp\1000020001\super9.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1000020001\super9.exe"
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                PID:2328
                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                5⤵
                                                                                • Blocklisted process makes network request
                                                                                • Loads dropped DLL
                                                                                • Accesses Microsoft Outlook profiles
                                                                                PID:5248
                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main
                                                                            3⤵
                                                                            • Blocklisted process makes network request
                                                                            • Loads dropped DLL
                                                                            • Accesses Microsoft Outlook profiles
                                                                            PID:5496
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 1136
                                                                          2⤵
                                                                          • Program crash
                                                                          PID:2076
                                                                      • C:\Users\Admin\AppData\Local\Temp\DDA6.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\DDA6.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Checks SCSI registry key(s)
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        PID:4116
                                                                      • C:\Users\Admin\AppData\Local\Temp\E018.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\E018.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:4084
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 340
                                                                          2⤵
                                                                          • Program crash
                                                                          PID:4420
                                                                      • C:\Users\Admin\AppData\Local\Temp\E25B.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\E25B.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:4904
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 340
                                                                          2⤵
                                                                          • Program crash
                                                                          PID:4892
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4252 -ip 4252
                                                                        1⤵
                                                                          PID:4964
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4084 -ip 4084
                                                                          1⤵
                                                                            PID:5080
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4904 -ip 4904
                                                                            1⤵
                                                                              PID:3336
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3520 -ip 3520
                                                                              1⤵
                                                                                PID:3952
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4288 -ip 4288
                                                                                1⤵
                                                                                  PID:368
                                                                                • C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1604
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 316
                                                                                    2⤵
                                                                                    • Program crash
                                                                                    PID:5920
                                                                                • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:540
                                                                                • C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:4620
                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:4964
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                                    2⤵
                                                                                    • Creates scheduled task(s)
                                                                                    PID:4548
                                                                                • C:\Windows\system32\rundll32.exe
                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                  1⤵
                                                                                  • Process spawned unexpected child process
                                                                                  PID:4900
                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:5040
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 608
                                                                                      3⤵
                                                                                      • Program crash
                                                                                      PID:2496
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4232 -ip 4232
                                                                                  1⤵
                                                                                    PID:4560
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5040 -ip 5040
                                                                                    1⤵
                                                                                      PID:4684
                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                      1⤵
                                                                                        PID:4468
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2096 -ip 2096
                                                                                        1⤵
                                                                                          PID:5696
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1604 -ip 1604
                                                                                          1⤵
                                                                                            PID:5900
                                                                                          • C:\Users\Admin\AppData\Local\Temp\94C4.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\94C4.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:3032
                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                              "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Oyiesauffusw.tmp",Wuuitfqhpt
                                                                                              2⤵
                                                                                              • Blocklisted process makes network request
                                                                                              • Loads dropped DLL
                                                                                              • Accesses Microsoft Outlook accounts
                                                                                              • Accesses Microsoft Outlook profiles
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Checks processor information in registry
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              • outlook_office_path
                                                                                              • outlook_win_path
                                                                                              PID:4184
                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 17133
                                                                                                3⤵
                                                                                                • Modifies registry class
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                PID:4048
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
                                                                                                3⤵
                                                                                                  PID:2408
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
                                                                                                  3⤵
                                                                                                    PID:5844
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 560
                                                                                                  2⤵
                                                                                                  • Program crash
                                                                                                  PID:5256
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3032 -ip 3032
                                                                                                1⤵
                                                                                                  PID:5200
                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                  1⤵
                                                                                                    PID:5452
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3420
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 316
                                                                                                      2⤵
                                                                                                      • Program crash
                                                                                                      PID:6036
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:1548
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4616
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3420 -ip 3420
                                                                                                    1⤵
                                                                                                      PID:6028

                                                                                                    Network

                                                                                                    MITRE ATT&CK Matrix ATT&CK v6

                                                                                                    Initial Access

                                                                                                    Execution

                                                                                                    Scripting

                                                                                                    1
                                                                                                    T1064

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053

                                                                                                    Persistence

                                                                                                    Registry Run Keys / Startup Folder

                                                                                                    1
                                                                                                    T1060

                                                                                                    Bootkit

                                                                                                    1
                                                                                                    T1067

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053

                                                                                                    Privilege Escalation

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053

                                                                                                    Defense Evasion

                                                                                                    Virtualization/Sandbox Evasion

                                                                                                    1
                                                                                                    T1497

                                                                                                    File Permissions Modification

                                                                                                    1
                                                                                                    T1222

                                                                                                    Scripting

                                                                                                    1
                                                                                                    T1064

                                                                                                    Modify Registry

                                                                                                    2
                                                                                                    T1112

                                                                                                    Credential Access

                                                                                                    Credentials in Files

                                                                                                    4
                                                                                                    T1081

                                                                                                    Discovery

                                                                                                    Query Registry

                                                                                                    7
                                                                                                    T1012

                                                                                                    Virtualization/Sandbox Evasion

                                                                                                    1
                                                                                                    T1497

                                                                                                    System Information Discovery

                                                                                                    7
                                                                                                    T1082

                                                                                                    Peripheral Device Discovery

                                                                                                    1
                                                                                                    T1120

                                                                                                    Lateral Movement

                                                                                                    Collection

                                                                                                    Data from Local System

                                                                                                    4
                                                                                                    T1005

                                                                                                    Email Collection

                                                                                                    2
                                                                                                    T1114

                                                                                                    Exfiltration

                                                                                                    Command and Control

                                                                                                    Web Service

                                                                                                    1
                                                                                                    T1102

                                                                                                    Impact

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      d725336098482e86274e5930393506a1

                                                                                                      SHA1

                                                                                                      7cb24085418693dc0c0fc876b6f7d2d400a7c256

                                                                                                      SHA256

                                                                                                      a2550a47e8dee78c170ecdfc8918137469b6115cf32fedc091b80c7dea2701a1

                                                                                                      SHA512

                                                                                                      f67ff810c97f14f9704439a7a3d34588b013eedc97149298c833926bc92d12b1e76b68c684863f86f8dede7fc677139f6c8af8e83bd43cad965ed32bda15ed3f

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                                                                                                      Filesize

                                                                                                      717B

                                                                                                      MD5

                                                                                                      ec8ff3b1ded0246437b1472c69dd1811

                                                                                                      SHA1

                                                                                                      d813e874c2524e3a7da6c466c67854ad16800326

                                                                                                      SHA256

                                                                                                      e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

                                                                                                      SHA512

                                                                                                      e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      bae107243c3c1cc23eb066f981b79948

                                                                                                      SHA1

                                                                                                      ed066a4326ae4eb5db4b00b0bb0290f006ad456c

                                                                                                      SHA256

                                                                                                      7d2ba9f4e363368512dc2388d792c3f971d18699234c4edab57ddd4053870026

                                                                                                      SHA512

                                                                                                      67a0ba993ab7abab0973683f134d71ed96cbff33368b222fc84e57def50c57d1c6d1c64362738baa9efa8cd84a3ccee30cc67284b2cd8ea53cbb8d1bfed94764

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                      Filesize

                                                                                                      488B

                                                                                                      MD5

                                                                                                      091500f3eb6629395fcc7b3945943ecd

                                                                                                      SHA1

                                                                                                      57761898dd3aeb24105bf1d20b31c8eaa941c557

                                                                                                      SHA256

                                                                                                      ae009001466cfd87f2d1e249a87b9f3b134cf2c027655f1026590b72364614b3

                                                                                                      SHA512

                                                                                                      a55d5af81f29dbd40c038b14621220fd25ba6b1f1de44f62ead9357b61ee04bdce199b6359c4a7e124cc16269d849b14c50566b5be08f4ef9ac0399092f80383

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                                                                                                      Filesize

                                                                                                      192B

                                                                                                      MD5

                                                                                                      411164d33c75694fece515a0ede87fb1

                                                                                                      SHA1

                                                                                                      cd84149d88fd6e68e85477613d3037ff97eee7cf

                                                                                                      SHA256

                                                                                                      e7e8f120a48f696c97d4a07cb5a21888a6380986f971bafeadcd0b11253d6eba

                                                                                                      SHA512

                                                                                                      d159e404afa47e3981475b442fa3b63b665b21a2c7eec3e992b4f227b74d66600b0215d5183b22ceedda061d54202eb0522cb3c4a989446e932b7ac902df38ed

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                      Filesize

                                                                                                      482B

                                                                                                      MD5

                                                                                                      be65ec2b4132e4ebbe97cd928152b5cb

                                                                                                      SHA1

                                                                                                      5a83c0ced9fd5e9f9d970435e29622d60fda4be7

                                                                                                      SHA256

                                                                                                      724ba7927628161bd436085ded38eba204378995231ef3730ed56ab931d8b737

                                                                                                      SHA512

                                                                                                      31d38a994d4498be17bdde2f05f113d7a13d2fcd215eeeff8853fc073acf9e473b895247e7bbb14409950aae3476e9fc37c00c3f6726a41c1e4dec05c5524597

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe
                                                                                                      Filesize

                                                                                                      409KB

                                                                                                      MD5

                                                                                                      a131064868de7468d2e768211431401b

                                                                                                      SHA1

                                                                                                      381ad582f72b30b4764afe0a817569b384be65a2

                                                                                                      SHA256

                                                                                                      027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

                                                                                                      SHA512

                                                                                                      40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe
                                                                                                      Filesize

                                                                                                      409KB

                                                                                                      MD5

                                                                                                      a131064868de7468d2e768211431401b

                                                                                                      SHA1

                                                                                                      381ad582f72b30b4764afe0a817569b384be65a2

                                                                                                      SHA256

                                                                                                      027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

                                                                                                      SHA512

                                                                                                      40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build2.exe
                                                                                                      Filesize

                                                                                                      409KB

                                                                                                      MD5

                                                                                                      a131064868de7468d2e768211431401b

                                                                                                      SHA1

                                                                                                      381ad582f72b30b4764afe0a817569b384be65a2

                                                                                                      SHA256

                                                                                                      027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

                                                                                                      SHA512

                                                                                                      40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build3.exe
                                                                                                      Filesize

                                                                                                      9KB

                                                                                                      MD5

                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                      SHA1

                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                      SHA256

                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                      SHA512

                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\14321bf7-dc85-4fc0-a43c-c45eed495e74\build3.exe
                                                                                                      Filesize

                                                                                                      9KB

                                                                                                      MD5

                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                      SHA1

                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                      SHA256

                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                      SHA512

                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe
                                                                                                      Filesize

                                                                                                      29KB

                                                                                                      MD5

                                                                                                      1496b98fe0530da47982105a87a69bce

                                                                                                      SHA1

                                                                                                      00719a1b168c8baa3827a161326b157713f9a07a

                                                                                                      SHA256

                                                                                                      c7c03c2d6a78eb79409a53304bfaf8a69334d2f6a5928db641092bcc39dc8e8d

                                                                                                      SHA512

                                                                                                      286c28a228dda2d589e7e5a75027c27fcc69244b8fec2ae1019d66a8fe6aa00ef245682a1e2dd3f37722c9c4220f2ddc52ab8750369842da028970c59513dcc6

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe
                                                                                                      Filesize

                                                                                                      29KB

                                                                                                      MD5

                                                                                                      1496b98fe0530da47982105a87a69bce

                                                                                                      SHA1

                                                                                                      00719a1b168c8baa3827a161326b157713f9a07a

                                                                                                      SHA256

                                                                                                      c7c03c2d6a78eb79409a53304bfaf8a69334d2f6a5928db641092bcc39dc8e8d

                                                                                                      SHA512

                                                                                                      286c28a228dda2d589e7e5a75027c27fcc69244b8fec2ae1019d66a8fe6aa00ef245682a1e2dd3f37722c9c4220f2ddc52ab8750369842da028970c59513dcc6

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000002001\bin.exe
                                                                                                      Filesize

                                                                                                      225KB

                                                                                                      MD5

                                                                                                      6a59c469713da7bb9abc4b8f2e8ac6da

                                                                                                      SHA1

                                                                                                      e87a23b50b3f3a41c50d62e558153d3a3010a02b

                                                                                                      SHA256

                                                                                                      3d21285ae1a22e1954c31393ce1a7238054d9a78b5ec7560235261cb99df918d

                                                                                                      SHA512

                                                                                                      16e7c44c8026016439f2c2eac8ae05a7f0ae6115882897d885837a6f5c37c3b19f5cba53202e691a11e632615d921adb50979077d0e50898cce49d2fbe7bca65

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000002001\bin.exe
                                                                                                      Filesize

                                                                                                      225KB

                                                                                                      MD5

                                                                                                      6a59c469713da7bb9abc4b8f2e8ac6da

                                                                                                      SHA1

                                                                                                      e87a23b50b3f3a41c50d62e558153d3a3010a02b

                                                                                                      SHA256

                                                                                                      3d21285ae1a22e1954c31393ce1a7238054d9a78b5ec7560235261cb99df918d

                                                                                                      SHA512

                                                                                                      16e7c44c8026016439f2c2eac8ae05a7f0ae6115882897d885837a6f5c37c3b19f5cba53202e691a11e632615d921adb50979077d0e50898cce49d2fbe7bca65

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000003001\Livability.exe
                                                                                                      Filesize

                                                                                                      403KB

                                                                                                      MD5

                                                                                                      3229c8c943f3a2ba40334e2b1240d0d8

                                                                                                      SHA1

                                                                                                      d214944064dd7d5ebed41f514013f297feff8109

                                                                                                      SHA256

                                                                                                      de7c689d14ca60ffa4258d96b7b8911180aaaa5668bc9785ba27b3cdb44a28a2

                                                                                                      SHA512

                                                                                                      779590ffcd0261fb9521257cbf76b04311d3a4481766636abdc0cf153981ef5cc769df4691b0575ce5b4ad9062feb97899d18ffc8a110946ba5a436f78306df4

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000003001\Livability.exe
                                                                                                      Filesize

                                                                                                      403KB

                                                                                                      MD5

                                                                                                      3229c8c943f3a2ba40334e2b1240d0d8

                                                                                                      SHA1

                                                                                                      d214944064dd7d5ebed41f514013f297feff8109

                                                                                                      SHA256

                                                                                                      de7c689d14ca60ffa4258d96b7b8911180aaaa5668bc9785ba27b3cdb44a28a2

                                                                                                      SHA512

                                                                                                      779590ffcd0261fb9521257cbf76b04311d3a4481766636abdc0cf153981ef5cc769df4691b0575ce5b4ad9062feb97899d18ffc8a110946ba5a436f78306df4

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000004051\trud.exe
                                                                                                      Filesize

                                                                                                      346KB

                                                                                                      MD5

                                                                                                      020902f785bf718ab5e94ea1e96dc730

                                                                                                      SHA1

                                                                                                      35dee2365846cbaf6829f8d6dcbf8d2826fc873f

                                                                                                      SHA256

                                                                                                      a31f3ce34cb36681e790afecba9a461afbde1226d70b2bee0758a6a6294aa674

                                                                                                      SHA512

                                                                                                      c8de5da189a88ac88441a349e083343f6f70bbf02214afdcf83840d3e08a5f9ca3b9ae3e78a5a99017a8f2daa3461ab4c187d20969c6de51e9a3a4133071bfc5

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000004051\trud.exe
                                                                                                      Filesize

                                                                                                      346KB

                                                                                                      MD5

                                                                                                      020902f785bf718ab5e94ea1e96dc730

                                                                                                      SHA1

                                                                                                      35dee2365846cbaf6829f8d6dcbf8d2826fc873f

                                                                                                      SHA256

                                                                                                      a31f3ce34cb36681e790afecba9a461afbde1226d70b2bee0758a6a6294aa674

                                                                                                      SHA512

                                                                                                      c8de5da189a88ac88441a349e083343f6f70bbf02214afdcf83840d3e08a5f9ca3b9ae3e78a5a99017a8f2daa3461ab4c187d20969c6de51e9a3a4133071bfc5

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000005051\linda5.exe
                                                                                                      Filesize

                                                                                                      1.5MB

                                                                                                      MD5

                                                                                                      54f15563117da20b22b49641a4f97ba1

                                                                                                      SHA1

                                                                                                      5bd84b175075e754791ad024fbeb2bed03c3f94c

                                                                                                      SHA256

                                                                                                      deda18b3ad01d443139f40a9d9433a63e68d3dcd0af8eeda13cc8115aeb6b838

                                                                                                      SHA512

                                                                                                      a2e06542a2abc57d19dcb63a64bc588bd1d2624725819adc65a01110bd7986c864a7dae939f12d07f4b6ef15c8df8872ac4dfb7a8b0f85eef4771009b54d9249

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000005051\linda5.exe
                                                                                                      Filesize

                                                                                                      1.5MB

                                                                                                      MD5

                                                                                                      54f15563117da20b22b49641a4f97ba1

                                                                                                      SHA1

                                                                                                      5bd84b175075e754791ad024fbeb2bed03c3f94c

                                                                                                      SHA256

                                                                                                      deda18b3ad01d443139f40a9d9433a63e68d3dcd0af8eeda13cc8115aeb6b838

                                                                                                      SHA512

                                                                                                      a2e06542a2abc57d19dcb63a64bc588bd1d2624725819adc65a01110bd7986c864a7dae939f12d07f4b6ef15c8df8872ac4dfb7a8b0f85eef4771009b54d9249

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000006001\z1ugk979.exe
                                                                                                      Filesize

                                                                                                      434KB

                                                                                                      MD5

                                                                                                      16f7152d86e037dbb89ec3db76f30fb7

                                                                                                      SHA1

                                                                                                      ba2908a7a1b6706c26a2187b8ba476b9400e50a8

                                                                                                      SHA256

                                                                                                      73b110d9cc838628a97f5e9fabdb49b2df33a90b3b8c61e59e8ae850df88abab

                                                                                                      SHA512

                                                                                                      3e51aaa84dabe5d37ea12f7946405d646882aaf5ac1bc25c4aeda7048d5f5d137285cb441f92e513e8669bda425c62e46fa85b95314b17e2a2f89af4576cb022

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000006001\z1ugk979.exe
                                                                                                      Filesize

                                                                                                      434KB

                                                                                                      MD5

                                                                                                      16f7152d86e037dbb89ec3db76f30fb7

                                                                                                      SHA1

                                                                                                      ba2908a7a1b6706c26a2187b8ba476b9400e50a8

                                                                                                      SHA256

                                                                                                      73b110d9cc838628a97f5e9fabdb49b2df33a90b3b8c61e59e8ae850df88abab

                                                                                                      SHA512

                                                                                                      3e51aaa84dabe5d37ea12f7946405d646882aaf5ac1bc25c4aeda7048d5f5d137285cb441f92e513e8669bda425c62e46fa85b95314b17e2a2f89af4576cb022

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000008001\csgd2.exe
                                                                                                      Filesize

                                                                                                      4.4MB

                                                                                                      MD5

                                                                                                      49f7e7a159774bdf056aed4fa46923dd

                                                                                                      SHA1

                                                                                                      1dbb57aeed6a7fa2bf516835d5013d6d7429e268

                                                                                                      SHA256

                                                                                                      0fe374cd82f2f922d0ae727ea182b86dc8a9838ad00e5fac6d0d8f673d1d36fd

                                                                                                      SHA512

                                                                                                      faaf85488753eec1ceb663c518b041488f3d970eb7935e9d584c0a52223439967bc782e79de86a2bc70a5b6e1e483c5235ab8a3749bacba32b4b5cb01b7ced39

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000008001\csgd2.exe
                                                                                                      Filesize

                                                                                                      4.4MB

                                                                                                      MD5

                                                                                                      49f7e7a159774bdf056aed4fa46923dd

                                                                                                      SHA1

                                                                                                      1dbb57aeed6a7fa2bf516835d5013d6d7429e268

                                                                                                      SHA256

                                                                                                      0fe374cd82f2f922d0ae727ea182b86dc8a9838ad00e5fac6d0d8f673d1d36fd

                                                                                                      SHA512

                                                                                                      faaf85488753eec1ceb663c518b041488f3d970eb7935e9d584c0a52223439967bc782e79de86a2bc70a5b6e1e483c5235ab8a3749bacba32b4b5cb01b7ced39

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000009001\mp3studios_97.exe
                                                                                                      Filesize

                                                                                                      1.4MB

                                                                                                      MD5

                                                                                                      e43f1f1ddaab485bc4add19e6a287961

                                                                                                      SHA1

                                                                                                      aca20dc9c91d15a2d745e8c0eb0f4b88aa9c51e6

                                                                                                      SHA256

                                                                                                      860d80b5d9206f6621dcb8302ad4a06a04d3e4c0ac211ee8077e9e3952680de0

                                                                                                      SHA512

                                                                                                      7c6c907e64054e70341eebb205c41a0cce9797ade7897341f2380af16cfdd979192e39857b0bda220f6d605e496ceae96d01f3d65af460bc4f3c9993d95b9bbb

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000009001\mp3studios_97.exe
                                                                                                      Filesize

                                                                                                      1.4MB

                                                                                                      MD5

                                                                                                      e43f1f1ddaab485bc4add19e6a287961

                                                                                                      SHA1

                                                                                                      aca20dc9c91d15a2d745e8c0eb0f4b88aa9c51e6

                                                                                                      SHA256

                                                                                                      860d80b5d9206f6621dcb8302ad4a06a04d3e4c0ac211ee8077e9e3952680de0

                                                                                                      SHA512

                                                                                                      7c6c907e64054e70341eebb205c41a0cce9797ade7897341f2380af16cfdd979192e39857b0bda220f6d605e496ceae96d01f3d65af460bc4f3c9993d95b9bbb

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000010001\random.exe
                                                                                                      Filesize

                                                                                                      135KB

                                                                                                      MD5

                                                                                                      10e9f08a128e0a4f26427ecdd1293646

                                                                                                      SHA1

                                                                                                      61967c24f67ba1b0194d74f9dd7f8d8e95c8df0a

                                                                                                      SHA256

                                                                                                      781f273dcf2fc98a60b600dc16b52f41a25e5d701212c1822ada88a8ce15e9db

                                                                                                      SHA512

                                                                                                      926abad90e879365426ba5203cd188726254392c73f3e23fa14f9656a8745f00994f4077c899dd9280bdc33b4140198bbd867cdc529fd3b2574dee45932a389b

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000010001\random.exe
                                                                                                      Filesize

                                                                                                      135KB

                                                                                                      MD5

                                                                                                      10e9f08a128e0a4f26427ecdd1293646

                                                                                                      SHA1

                                                                                                      61967c24f67ba1b0194d74f9dd7f8d8e95c8df0a

                                                                                                      SHA256

                                                                                                      781f273dcf2fc98a60b600dc16b52f41a25e5d701212c1822ada88a8ce15e9db

                                                                                                      SHA512

                                                                                                      926abad90e879365426ba5203cd188726254392c73f3e23fa14f9656a8745f00994f4077c899dd9280bdc33b4140198bbd867cdc529fd3b2574dee45932a389b

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000010001\random.exe
                                                                                                      Filesize

                                                                                                      135KB

                                                                                                      MD5

                                                                                                      10e9f08a128e0a4f26427ecdd1293646

                                                                                                      SHA1

                                                                                                      61967c24f67ba1b0194d74f9dd7f8d8e95c8df0a

                                                                                                      SHA256

                                                                                                      781f273dcf2fc98a60b600dc16b52f41a25e5d701212c1822ada88a8ce15e9db

                                                                                                      SHA512

                                                                                                      926abad90e879365426ba5203cd188726254392c73f3e23fa14f9656a8745f00994f4077c899dd9280bdc33b4140198bbd867cdc529fd3b2574dee45932a389b

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000040001\super9.exe
                                                                                                      Filesize

                                                                                                      45KB

                                                                                                      MD5

                                                                                                      4439bff7fec557da1fb9ed754a838be7

                                                                                                      SHA1

                                                                                                      1aac2acba06be9d26209fe5b8b236315a0f8f387

                                                                                                      SHA256

                                                                                                      0283da2469f040a2aadcb65856947035f98dca525639670e658f7bdbe9d4f912

                                                                                                      SHA512

                                                                                                      c277587bb27d13ac18edc1eadf2ba1e1638ba027de7303d45857ece5e3104b4eb9f7f1e67043f02c0a9785893827960e40c35a0661a02d28dfd0d7674db4a243

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000040001\super9.exe
                                                                                                      Filesize

                                                                                                      45KB

                                                                                                      MD5

                                                                                                      4439bff7fec557da1fb9ed754a838be7

                                                                                                      SHA1

                                                                                                      1aac2acba06be9d26209fe5b8b236315a0f8f387

                                                                                                      SHA256

                                                                                                      0283da2469f040a2aadcb65856947035f98dca525639670e658f7bdbe9d4f912

                                                                                                      SHA512

                                                                                                      c277587bb27d13ac18edc1eadf2ba1e1638ba027de7303d45857ece5e3104b4eb9f7f1e67043f02c0a9785893827960e40c35a0661a02d28dfd0d7674db4a243

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000050001\Legs.exe
                                                                                                      Filesize

                                                                                                      235KB

                                                                                                      MD5

                                                                                                      15f57d45fe2a1e8da248cf9b3723d775

                                                                                                      SHA1

                                                                                                      aafb9168ed62dc2ebeeb8428c3a39a6525142f6c

                                                                                                      SHA256

                                                                                                      bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a

                                                                                                      SHA512

                                                                                                      aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000050001\Legs.exe
                                                                                                      Filesize

                                                                                                      235KB

                                                                                                      MD5

                                                                                                      15f57d45fe2a1e8da248cf9b3723d775

                                                                                                      SHA1

                                                                                                      aafb9168ed62dc2ebeeb8428c3a39a6525142f6c

                                                                                                      SHA256

                                                                                                      bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a

                                                                                                      SHA512

                                                                                                      aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe
                                                                                                      Filesize

                                                                                                      281KB

                                                                                                      MD5

                                                                                                      02a0070645d2af08116cdba2361f8b18

                                                                                                      SHA1

                                                                                                      7e763de143b5fe11f2d241828f9e813098d62fb8

                                                                                                      SHA256

                                                                                                      c58821dd98726193166e6eb0f0d188497c43229ce38cb0de0e71ba5a51ae81fe

                                                                                                      SHA512

                                                                                                      88c019551fa4182899c6f90b739e2cee78e8a8f92342af889fb053746221171ef62c14b532e3a595c1c7842bdd5e0a3ff28246ee0f8cd0ec5139ce5c58829d3c

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe
                                                                                                      Filesize

                                                                                                      281KB

                                                                                                      MD5

                                                                                                      02a0070645d2af08116cdba2361f8b18

                                                                                                      SHA1

                                                                                                      7e763de143b5fe11f2d241828f9e813098d62fb8

                                                                                                      SHA256

                                                                                                      c58821dd98726193166e6eb0f0d188497c43229ce38cb0de0e71ba5a51ae81fe

                                                                                                      SHA512

                                                                                                      88c019551fa4182899c6f90b739e2cee78e8a8f92342af889fb053746221171ef62c14b532e3a595c1c7842bdd5e0a3ff28246ee0f8cd0ec5139ce5c58829d3c

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\35731ceaf0\gntuud.exe
                                                                                                      Filesize

                                                                                                      281KB

                                                                                                      MD5

                                                                                                      02a0070645d2af08116cdba2361f8b18

                                                                                                      SHA1

                                                                                                      7e763de143b5fe11f2d241828f9e813098d62fb8

                                                                                                      SHA256

                                                                                                      c58821dd98726193166e6eb0f0d188497c43229ce38cb0de0e71ba5a51ae81fe

                                                                                                      SHA512

                                                                                                      88c019551fa4182899c6f90b739e2cee78e8a8f92342af889fb053746221171ef62c14b532e3a595c1c7842bdd5e0a3ff28246ee0f8cd0ec5139ce5c58829d3c

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D6CD.exe
                                                                                                      Filesize

                                                                                                      399KB

                                                                                                      MD5

                                                                                                      b0ece045401c25a90ae1ba804bb43398

                                                                                                      SHA1

                                                                                                      455c85e07d9b6dbd53fce17bc16a2275d49ac855

                                                                                                      SHA256

                                                                                                      26924a35a830aa53611550b2be4e98b445fd091f5da187350cd7fcb532c265fa

                                                                                                      SHA512

                                                                                                      3e9d24cf4916b5aec9bfadc860cc40ab7afcb0029f53af0449a37cf39b90f5de2973cc76ef65449a74357db5c4a8a39e3fd4c83f6caeb8c8cde10c4e33513fdb

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D6CD.exe
                                                                                                      Filesize

                                                                                                      399KB

                                                                                                      MD5

                                                                                                      b0ece045401c25a90ae1ba804bb43398

                                                                                                      SHA1

                                                                                                      455c85e07d9b6dbd53fce17bc16a2275d49ac855

                                                                                                      SHA256

                                                                                                      26924a35a830aa53611550b2be4e98b445fd091f5da187350cd7fcb532c265fa

                                                                                                      SHA512

                                                                                                      3e9d24cf4916b5aec9bfadc860cc40ab7afcb0029f53af0449a37cf39b90f5de2973cc76ef65449a74357db5c4a8a39e3fd4c83f6caeb8c8cde10c4e33513fdb

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D806.exe
                                                                                                      Filesize

                                                                                                      747KB

                                                                                                      MD5

                                                                                                      4c025d31ed338ed31c7083a4d35b2bab

                                                                                                      SHA1

                                                                                                      d0173a789dc4c10d9645bbee965d416c065ab08a

                                                                                                      SHA256

                                                                                                      c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a

                                                                                                      SHA512

                                                                                                      d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D806.exe
                                                                                                      Filesize

                                                                                                      747KB

                                                                                                      MD5

                                                                                                      4c025d31ed338ed31c7083a4d35b2bab

                                                                                                      SHA1

                                                                                                      d0173a789dc4c10d9645bbee965d416c065ab08a

                                                                                                      SHA256

                                                                                                      c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a

                                                                                                      SHA512

                                                                                                      d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D806.exe
                                                                                                      Filesize

                                                                                                      747KB

                                                                                                      MD5

                                                                                                      4c025d31ed338ed31c7083a4d35b2bab

                                                                                                      SHA1

                                                                                                      d0173a789dc4c10d9645bbee965d416c065ab08a

                                                                                                      SHA256

                                                                                                      c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a

                                                                                                      SHA512

                                                                                                      d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D806.exe
                                                                                                      Filesize

                                                                                                      747KB

                                                                                                      MD5

                                                                                                      4c025d31ed338ed31c7083a4d35b2bab

                                                                                                      SHA1

                                                                                                      d0173a789dc4c10d9645bbee965d416c065ab08a

                                                                                                      SHA256

                                                                                                      c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a

                                                                                                      SHA512

                                                                                                      d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D806.exe
                                                                                                      Filesize

                                                                                                      747KB

                                                                                                      MD5

                                                                                                      4c025d31ed338ed31c7083a4d35b2bab

                                                                                                      SHA1

                                                                                                      d0173a789dc4c10d9645bbee965d416c065ab08a

                                                                                                      SHA256

                                                                                                      c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a

                                                                                                      SHA512

                                                                                                      d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DA78.exe
                                                                                                      Filesize

                                                                                                      281KB

                                                                                                      MD5

                                                                                                      02a0070645d2af08116cdba2361f8b18

                                                                                                      SHA1

                                                                                                      7e763de143b5fe11f2d241828f9e813098d62fb8

                                                                                                      SHA256

                                                                                                      c58821dd98726193166e6eb0f0d188497c43229ce38cb0de0e71ba5a51ae81fe

                                                                                                      SHA512

                                                                                                      88c019551fa4182899c6f90b739e2cee78e8a8f92342af889fb053746221171ef62c14b532e3a595c1c7842bdd5e0a3ff28246ee0f8cd0ec5139ce5c58829d3c

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DA78.exe
                                                                                                      Filesize

                                                                                                      281KB

                                                                                                      MD5

                                                                                                      02a0070645d2af08116cdba2361f8b18

                                                                                                      SHA1

                                                                                                      7e763de143b5fe11f2d241828f9e813098d62fb8

                                                                                                      SHA256

                                                                                                      c58821dd98726193166e6eb0f0d188497c43229ce38cb0de0e71ba5a51ae81fe

                                                                                                      SHA512

                                                                                                      88c019551fa4182899c6f90b739e2cee78e8a8f92342af889fb053746221171ef62c14b532e3a595c1c7842bdd5e0a3ff28246ee0f8cd0ec5139ce5c58829d3c

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DDA6.exe
                                                                                                      Filesize

                                                                                                      226KB

                                                                                                      MD5

                                                                                                      71ee1e0898006c39e633574d61cc817c

                                                                                                      SHA1

                                                                                                      8ed8feec771c823cf3c0caca842a019b8aa2912a

                                                                                                      SHA256

                                                                                                      77467614ff0ccab1245707fb61c452840fb269c30e1513f38ea316c2e97fcea4

                                                                                                      SHA512

                                                                                                      d7637bce73844fe1ecf891a6d1c0f3d9a534621b1565b63c32b94c5759d0a4e0ddc918c6e45efcdc80b9cb91397f44afbb5bf7134b351dd26799b4330119435f

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DDA6.exe
                                                                                                      Filesize

                                                                                                      226KB

                                                                                                      MD5

                                                                                                      71ee1e0898006c39e633574d61cc817c

                                                                                                      SHA1

                                                                                                      8ed8feec771c823cf3c0caca842a019b8aa2912a

                                                                                                      SHA256

                                                                                                      77467614ff0ccab1245707fb61c452840fb269c30e1513f38ea316c2e97fcea4

                                                                                                      SHA512

                                                                                                      d7637bce73844fe1ecf891a6d1c0f3d9a534621b1565b63c32b94c5759d0a4e0ddc918c6e45efcdc80b9cb91397f44afbb5bf7134b351dd26799b4330119435f

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E018.exe
                                                                                                      Filesize

                                                                                                      280KB

                                                                                                      MD5

                                                                                                      4aeec3636d36e14a4d15d8914979eedd

                                                                                                      SHA1

                                                                                                      991129eb11c0a58a83eb5714f63d686ea0d76464

                                                                                                      SHA256

                                                                                                      0b8330da973e5f9cb260b78e1a745253574bc74b0b3df926fc917e129fb418d2

                                                                                                      SHA512

                                                                                                      1f0b829b9c8d08efb5561492afc4c714aa14b0f9adf719d16c67e2163bde384ef782972e558d1d4d5218329d29f0b4e0c845ab62b7c17b3d5863a9f94472a96d

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E018.exe
                                                                                                      Filesize

                                                                                                      280KB

                                                                                                      MD5

                                                                                                      4aeec3636d36e14a4d15d8914979eedd

                                                                                                      SHA1

                                                                                                      991129eb11c0a58a83eb5714f63d686ea0d76464

                                                                                                      SHA256

                                                                                                      0b8330da973e5f9cb260b78e1a745253574bc74b0b3df926fc917e129fb418d2

                                                                                                      SHA512

                                                                                                      1f0b829b9c8d08efb5561492afc4c714aa14b0f9adf719d16c67e2163bde384ef782972e558d1d4d5218329d29f0b4e0c845ab62b7c17b3d5863a9f94472a96d

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E25B.exe
                                                                                                      Filesize

                                                                                                      226KB

                                                                                                      MD5

                                                                                                      4c0b5897de5dce06560135240ea223f7

                                                                                                      SHA1

                                                                                                      7a4f68edd1d5630db41b5ffef1f41dfd8261324e

                                                                                                      SHA256

                                                                                                      99856460a04e9b2615d0ffa7a1cb94a3f406eed95caab70fb2f496be0d7bdc9b

                                                                                                      SHA512

                                                                                                      d8ccb7f5ba2833835525353ded8c88b90e986e6024fa0c75b0ad54c7b9d57a4ab668174f5cf9625003d4010bc390d5409d9358a744777136130aa81acc09a4a2

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E25B.exe
                                                                                                      Filesize

                                                                                                      226KB

                                                                                                      MD5

                                                                                                      4c0b5897de5dce06560135240ea223f7

                                                                                                      SHA1

                                                                                                      7a4f68edd1d5630db41b5ffef1f41dfd8261324e

                                                                                                      SHA256

                                                                                                      99856460a04e9b2615d0ffa7a1cb94a3f406eed95caab70fb2f496be0d7bdc9b

                                                                                                      SHA512

                                                                                                      d8ccb7f5ba2833835525353ded8c88b90e986e6024fa0c75b0ad54c7b9d57a4ab668174f5cf9625003d4010bc390d5409d9358a744777136130aa81acc09a4a2

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
                                                                                                      Filesize

                                                                                                      225KB

                                                                                                      MD5

                                                                                                      6a59c469713da7bb9abc4b8f2e8ac6da

                                                                                                      SHA1

                                                                                                      e87a23b50b3f3a41c50d62e558153d3a3010a02b

                                                                                                      SHA256

                                                                                                      3d21285ae1a22e1954c31393ce1a7238054d9a78b5ec7560235261cb99df918d

                                                                                                      SHA512

                                                                                                      16e7c44c8026016439f2c2eac8ae05a7f0ae6115882897d885837a6f5c37c3b19f5cba53202e691a11e632615d921adb50979077d0e50898cce49d2fbe7bca65

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a4e2bd6d47\WinComService.exe
                                                                                                      Filesize

                                                                                                      225KB

                                                                                                      MD5

                                                                                                      6a59c469713da7bb9abc4b8f2e8ac6da

                                                                                                      SHA1

                                                                                                      e87a23b50b3f3a41c50d62e558153d3a3010a02b

                                                                                                      SHA256

                                                                                                      3d21285ae1a22e1954c31393ce1a7238054d9a78b5ec7560235261cb99df918d

                                                                                                      SHA512

                                                                                                      16e7c44c8026016439f2c2eac8ae05a7f0ae6115882897d885837a6f5c37c3b19f5cba53202e691a11e632615d921adb50979077d0e50898cce49d2fbe7bca65

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
                                                                                                      Filesize

                                                                                                      235KB

                                                                                                      MD5

                                                                                                      15f57d45fe2a1e8da248cf9b3723d775

                                                                                                      SHA1

                                                                                                      aafb9168ed62dc2ebeeb8428c3a39a6525142f6c

                                                                                                      SHA256

                                                                                                      bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a

                                                                                                      SHA512

                                                                                                      aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
                                                                                                      Filesize

                                                                                                      235KB

                                                                                                      MD5

                                                                                                      15f57d45fe2a1e8da248cf9b3723d775

                                                                                                      SHA1

                                                                                                      aafb9168ed62dc2ebeeb8428c3a39a6525142f6c

                                                                                                      SHA256

                                                                                                      bc73998864190a9562a117c1e4587cc39de1bc1017b369f4aa0c736cd39b353a

                                                                                                      SHA512

                                                                                                      aa0dea76d7677aa5773d1e0bf1ef8d297f8f30437318ebb13e5ca3fc029be758c9799004c5c6331aee68167e3b38796f572a4394f03eeb2023cf8a085efb1174

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\xHFA.3~E
                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      MD5

                                                                                                      f8f296db527fa0a84ec79f2ab7f2ece2

                                                                                                      SHA1

                                                                                                      995ae608998b3e869c10bbf33c15bc82941ebd40

                                                                                                      SHA256

                                                                                                      7b733810ccc0251d000179e396e2b030d9e71fcb38ce125fb5521effb4f745af

                                                                                                      SHA512

                                                                                                      c35287546f8c89afc74d760730c31c5e66287973c34a4b866a92a3a0af71857be65314997e02ed4ea6d965d48ce3cd4d7b0dd308e4e35dc4cedbc99e406d4c28

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\xHFA.3~e
                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      MD5

                                                                                                      f8f296db527fa0a84ec79f2ab7f2ece2

                                                                                                      SHA1

                                                                                                      995ae608998b3e869c10bbf33c15bc82941ebd40

                                                                                                      SHA256

                                                                                                      7b733810ccc0251d000179e396e2b030d9e71fcb38ce125fb5521effb4f745af

                                                                                                      SHA512

                                                                                                      c35287546f8c89afc74d760730c31c5e66287973c34a4b866a92a3a0af71857be65314997e02ed4ea6d965d48ce3cd4d7b0dd308e4e35dc4cedbc99e406d4c28

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\xHFA.3~e
                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      MD5

                                                                                                      f8f296db527fa0a84ec79f2ab7f2ece2

                                                                                                      SHA1

                                                                                                      995ae608998b3e869c10bbf33c15bc82941ebd40

                                                                                                      SHA256

                                                                                                      7b733810ccc0251d000179e396e2b030d9e71fcb38ce125fb5521effb4f745af

                                                                                                      SHA512

                                                                                                      c35287546f8c89afc74d760730c31c5e66287973c34a4b866a92a3a0af71857be65314997e02ed4ea6d965d48ce3cd4d7b0dd308e4e35dc4cedbc99e406d4c28

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Local\e7292bf6-0390-4308-a547-2325f5d851ca\D806.exe
                                                                                                      Filesize

                                                                                                      747KB

                                                                                                      MD5

                                                                                                      4c025d31ed338ed31c7083a4d35b2bab

                                                                                                      SHA1

                                                                                                      d0173a789dc4c10d9645bbee965d416c065ab08a

                                                                                                      SHA256

                                                                                                      c3828dffd8c8be197ef58cd00d30039bd54b4e364d08815c8f6317265cf6ea4a

                                                                                                      SHA512

                                                                                                      d769a5d9e0f035610d7d166d4726e1d278bf5879e18bdfc3386190d2b9a45674319dca7a4103ec6e54c2bb51aa09ef1b7c1d6293e33613c3970e1caca570a4ea

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Roaming\1000034050\system32.exe
                                                                                                      Filesize

                                                                                                      879KB

                                                                                                      MD5

                                                                                                      45f6980ec4c0108bb1103cbc1906fa18

                                                                                                      SHA1

                                                                                                      26504d9884c97a2fab9aa128148a5b36becf9e92

                                                                                                      SHA256

                                                                                                      8bc19641f9095f8c86c3836cf1f9d7b1dd14a1c62da0320ce09d5e27d0104927

                                                                                                      SHA512

                                                                                                      64fc21f11fc4bfbd485111695ee2ac9e1e70f4107893e259aa4d705a7ad647e7968f3c223d8d647124c8b0d8f041bae074c600a0ae168b0eb166cd62ee877049

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Roaming\1000034050\system32.exe
                                                                                                      Filesize

                                                                                                      879KB

                                                                                                      MD5

                                                                                                      45f6980ec4c0108bb1103cbc1906fa18

                                                                                                      SHA1

                                                                                                      26504d9884c97a2fab9aa128148a5b36becf9e92

                                                                                                      SHA256

                                                                                                      8bc19641f9095f8c86c3836cf1f9d7b1dd14a1c62da0320ce09d5e27d0104927

                                                                                                      SHA512

                                                                                                      64fc21f11fc4bfbd485111695ee2ac9e1e70f4107893e259aa4d705a7ad647e7968f3c223d8d647124c8b0d8f041bae074c600a0ae168b0eb166cd62ee877049

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Roaming\1000038050\bd.exe
                                                                                                      Filesize

                                                                                                      1.4MB

                                                                                                      MD5

                                                                                                      afd26f223230ad20eb208dbaa0164e43

                                                                                                      SHA1

                                                                                                      9c92cde80d982dec72e5a2fb6553bc1cd89e8319

                                                                                                      SHA256

                                                                                                      fc0cb0682ccc37bdd72fab5106d45ebf7fb014b15004d65d627f6e2aed0750b4

                                                                                                      SHA512

                                                                                                      e0e284ffdd4ef7421a0c0ffb1cf6e2aa82707a861be84e98713a3efd385f1347d8c869709d941d19c0fb3df0d7e40aec1803fb14cc379cec98eeaf8e196aefce

                                                                                                      Download Submit
                                                                                                    • C:\Users\Admin\AppData\Roaming\1000038050\bd.exe
                                                                                                      Filesize

                                                                                                      1.4MB

                                                                                                      MD5

                                                                                                      afd26f223230ad20eb208dbaa0164e43

                                                                                                      SHA1

                                                                                                      9c92cde80d982dec72e5a2fb6553bc1cd89e8319

                                                                                                      SHA256

                                                                                                      fc0cb0682ccc37bdd72fab5106d45ebf7fb014b15004d65d627f6e2aed0750b4

                                                                                                      SHA512

                                                                                                      e0e284ffdd4ef7421a0c0ffb1cf6e2aa82707a861be84e98713a3efd385f1347d8c869709d941d19c0fb3df0d7e40aec1803fb14cc379cec98eeaf8e196aefce

                                                                                                      Download Submit
                                                                                                    • memory/404-260-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/432-201-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/452-151-0x0000000000440000-0x00000000004AA000-memory.dmp
                                                                                                      Filesize

                                                                                                      424KB

                                                                                                      Download
                                                                                                    • memory/452-136-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/688-236-0x0000000007EF0000-0x000000000841C000-memory.dmp
                                                                                                      Filesize

                                                                                                      5.2MB

                                                                                                      Download
                                                                                                    • memory/688-193-0x0000000006D20000-0x00000000072C4000-memory.dmp
                                                                                                      Filesize

                                                                                                      5.6MB

                                                                                                      Download
                                                                                                    • memory/688-156-0x0000000005760000-0x000000000586A000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.0MB

                                                                                                      Download
                                                                                                    • memory/688-159-0x00000000056F0000-0x000000000572C000-memory.dmp
                                                                                                      Filesize

                                                                                                      240KB

                                                                                                      Download
                                                                                                    • memory/688-157-0x0000000005690000-0x00000000056A2000-memory.dmp
                                                                                                      Filesize

                                                                                                      72KB

                                                                                                      Download
                                                                                                    • memory/688-235-0x0000000006AC0000-0x0000000006C82000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/688-155-0x0000000005C60000-0x0000000006278000-memory.dmp
                                                                                                      Filesize

                                                                                                      6.1MB

                                                                                                      Download
                                                                                                    • memory/688-143-0x0000000000400000-0x0000000000460000-memory.dmp
                                                                                                      Filesize

                                                                                                      384KB

                                                                                                      Download
                                                                                                    • memory/688-142-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/688-192-0x0000000005A30000-0x0000000005AC2000-memory.dmp
                                                                                                      Filesize

                                                                                                      584KB

                                                                                                      Download
                                                                                                    • memory/688-194-0x0000000005BD0000-0x0000000005C36000-memory.dmp
                                                                                                      Filesize

                                                                                                      408KB

                                                                                                      Download
                                                                                                    • memory/1116-299-0x0000000000400000-0x0000000000436000-memory.dmp
                                                                                                      Filesize

                                                                                                      216KB

                                                                                                      Download
                                                                                                    • memory/1116-317-0x00000000069E0000-0x0000000006A56000-memory.dmp
                                                                                                      Filesize

                                                                                                      472KB

                                                                                                      Download
                                                                                                    • memory/1116-298-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/1116-321-0x00000000069B0000-0x00000000069CE000-memory.dmp
                                                                                                      Filesize

                                                                                                      120KB

                                                                                                      Download
                                                                                                    • memory/1188-231-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/1208-269-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/1456-328-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/1500-234-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/1696-330-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/1784-265-0x0000000000718000-0x0000000000746000-memory.dmp
                                                                                                      Filesize

                                                                                                      184KB

                                                                                                      Download
                                                                                                    • memory/1784-267-0x00000000005B0000-0x0000000000603000-memory.dmp
                                                                                                      Filesize

                                                                                                      332KB

                                                                                                      Download
                                                                                                    • memory/1784-253-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/1784-335-0x00000000005B0000-0x0000000000603000-memory.dmp
                                                                                                      Filesize

                                                                                                      332KB

                                                                                                      Download
                                                                                                    • memory/1964-174-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      Download
                                                                                                    • memory/1964-190-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      Download
                                                                                                    • memory/1964-166-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/1964-168-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      Download
                                                                                                    • memory/1964-171-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      Download
                                                                                                    • memory/1964-172-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      Download
                                                                                                    • memory/2096-316-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                      Filesize

                                                                                                      436KB

                                                                                                      Download
                                                                                                    • memory/2096-315-0x0000000002000000-0x0000000002053000-memory.dmp
                                                                                                      Filesize

                                                                                                      332KB

                                                                                                      Download
                                                                                                    • memory/2096-306-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/2096-314-0x000000000077E000-0x00000000007AC000-memory.dmp
                                                                                                      Filesize

                                                                                                      184KB

                                                                                                      Download
                                                                                                    • memory/2176-277-0x000000006C500000-0x000000006C6A5000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download
                                                                                                    • memory/2176-266-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/2176-324-0x00000000039D0000-0x0000000003AAC000-memory.dmp
                                                                                                      Filesize

                                                                                                      880KB

                                                                                                      Download
                                                                                                    • memory/2176-332-0x0000000001550000-0x0000000001618000-memory.dmp
                                                                                                      Filesize

                                                                                                      800KB

                                                                                                      Download
                                                                                                    • memory/2176-333-0x0000000001550000-0x0000000001618000-memory.dmp
                                                                                                      Filesize

                                                                                                      800KB

                                                                                                      Download
                                                                                                    • memory/2176-276-0x0000000003300000-0x0000000003485000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.5MB

                                                                                                      Download
                                                                                                    • memory/2184-230-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/2240-312-0x0000000000820000-0x0000000000832000-memory.dmp
                                                                                                      Filesize

                                                                                                      72KB

                                                                                                      Download
                                                                                                    • memory/2240-309-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/2240-313-0x00007FFA61340000-0x00007FFA61E01000-memory.dmp
                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                      Download
                                                                                                    • memory/2328-373-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/2344-366-0x0000000140000000-0x0000000140617000-memory.dmp
                                                                                                      Filesize

                                                                                                      6.1MB

                                                                                                      Download
                                                                                                    • memory/2344-365-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/2356-257-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/2360-372-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/2408-447-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/2728-135-0x0000000000400000-0x000000000045E000-memory.dmp
                                                                                                      Filesize

                                                                                                      376KB

                                                                                                      Download
                                                                                                    • memory/2728-134-0x0000000000400000-0x000000000045E000-memory.dmp
                                                                                                      Filesize

                                                                                                      376KB

                                                                                                      Download
                                                                                                    • memory/2728-133-0x00000000005A0000-0x00000000005A9000-memory.dmp
                                                                                                      Filesize

                                                                                                      36KB

                                                                                                      Download
                                                                                                    • memory/2728-132-0x000000000071B000-0x000000000072B000-memory.dmp
                                                                                                      Filesize

                                                                                                      64KB

                                                                                                      Download
                                                                                                    • memory/2884-211-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/2884-220-0x0000000000400000-0x0000000000409000-memory.dmp
                                                                                                      Filesize

                                                                                                      36KB

                                                                                                      Download
                                                                                                    • memory/3032-417-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/3124-233-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/3164-227-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/3232-228-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/3264-304-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      Download
                                                                                                    • memory/3264-205-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/3264-219-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      Download
                                                                                                    • memory/3264-210-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      Download
                                                                                                    • memory/3264-208-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      Download
                                                                                                    • memory/3336-338-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/3344-224-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/3488-376-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/3520-256-0x0000000000400000-0x0000000000529000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      Download
                                                                                                    • memory/3520-240-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/3520-244-0x0000000000400000-0x0000000000529000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      Download
                                                                                                    • memory/3520-246-0x0000000076750000-0x0000000076965000-memory.dmp
                                                                                                      Filesize

                                                                                                      2.1MB

                                                                                                      Download
                                                                                                    • memory/3520-243-0x0000000077CA0000-0x0000000077E43000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download
                                                                                                    • memory/3640-274-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/3744-318-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/3944-342-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4028-346-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4048-442-0x00007FF65FF46890-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4084-183-0x0000000000607000-0x0000000000625000-memory.dmp
                                                                                                      Filesize

                                                                                                      120KB

                                                                                                      Download
                                                                                                    • memory/4084-184-0x0000000000400000-0x000000000046B000-memory.dmp
                                                                                                      Filesize

                                                                                                      428KB

                                                                                                      Download
                                                                                                    • memory/4084-158-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4116-152-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4116-179-0x00000000005AB000-0x00000000005BC000-memory.dmp
                                                                                                      Filesize

                                                                                                      68KB

                                                                                                      Download
                                                                                                    • memory/4116-181-0x00000000004D0000-0x00000000004D9000-memory.dmp
                                                                                                      Filesize

                                                                                                      36KB

                                                                                                      Download
                                                                                                    • memory/4116-182-0x0000000000400000-0x000000000045E000-memory.dmp
                                                                                                      Filesize

                                                                                                      376KB

                                                                                                      Download
                                                                                                    • memory/4116-218-0x0000000000400000-0x000000000045E000-memory.dmp
                                                                                                      Filesize

                                                                                                      376KB

                                                                                                      Download
                                                                                                    • memory/4184-418-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4220-380-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4232-278-0x000000000067A000-0x00000000006A9000-memory.dmp
                                                                                                      Filesize

                                                                                                      188KB

                                                                                                      Download
                                                                                                    • memory/4232-279-0x00000000005F0000-0x000000000063B000-memory.dmp
                                                                                                      Filesize

                                                                                                      300KB

                                                                                                      Download
                                                                                                    • memory/4232-245-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4232-280-0x0000000000400000-0x000000000047C000-memory.dmp
                                                                                                      Filesize

                                                                                                      496KB

                                                                                                      Download
                                                                                                    • memory/4252-180-0x00000000006E0000-0x000000000071C000-memory.dmp
                                                                                                      Filesize

                                                                                                      240KB

                                                                                                      Download
                                                                                                    • memory/4252-169-0x00000000006E0000-0x000000000071C000-memory.dmp
                                                                                                      Filesize

                                                                                                      240KB

                                                                                                      Download
                                                                                                    • memory/4252-175-0x00000000007AB000-0x00000000007C9000-memory.dmp
                                                                                                      Filesize

                                                                                                      120KB

                                                                                                      Download
                                                                                                    • memory/4252-148-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4252-178-0x0000000000400000-0x000000000046B000-memory.dmp
                                                                                                      Filesize

                                                                                                      428KB

                                                                                                      Download
                                                                                                    • memory/4288-198-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4288-305-0x0000000000930000-0x000000000099F000-memory.dmp
                                                                                                      Filesize

                                                                                                      444KB

                                                                                                      Download
                                                                                                    • memory/4288-295-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4292-229-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4308-204-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4328-261-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4328-262-0x0000000000400000-0x0000000000467000-memory.dmp
                                                                                                      Filesize

                                                                                                      412KB

                                                                                                      Download
                                                                                                    • memory/4328-268-0x0000000000400000-0x0000000000467000-memory.dmp
                                                                                                      Filesize

                                                                                                      412KB

                                                                                                      Download
                                                                                                    • memory/4328-336-0x0000000060900000-0x0000000060992000-memory.dmp
                                                                                                      Filesize

                                                                                                      584KB

                                                                                                      Download
                                                                                                    • memory/4328-275-0x0000000000400000-0x0000000000467000-memory.dmp
                                                                                                      Filesize

                                                                                                      412KB

                                                                                                      Download
                                                                                                    • memory/4328-264-0x0000000000400000-0x0000000000467000-memory.dmp
                                                                                                      Filesize

                                                                                                      412KB

                                                                                                      Download
                                                                                                    • memory/4416-232-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4476-187-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4480-197-0x0000000000400000-0x000000000046B000-memory.dmp
                                                                                                      Filesize

                                                                                                      428KB

                                                                                                      Download
                                                                                                    • memory/4480-292-0x0000000000400000-0x000000000046B000-memory.dmp
                                                                                                      Filesize

                                                                                                      428KB

                                                                                                      Download
                                                                                                    • memory/4480-196-0x000000000062A000-0x0000000000648000-memory.dmp
                                                                                                      Filesize

                                                                                                      120KB

                                                                                                      Download
                                                                                                    • memory/4480-173-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4480-291-0x000000000062A000-0x0000000000648000-memory.dmp
                                                                                                      Filesize

                                                                                                      120KB

                                                                                                      Download
                                                                                                    • memory/4548-371-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4564-293-0x00000000005E0000-0x0000000000A42000-memory.dmp
                                                                                                      Filesize

                                                                                                      4.4MB

                                                                                                      Download
                                                                                                    • memory/4564-294-0x0000000077CA0000-0x0000000077E43000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      Download
                                                                                                    • memory/4564-284-0x00000000005E0000-0x0000000000A42000-memory.dmp
                                                                                                      Filesize

                                                                                                      4.4MB

                                                                                                      Download
                                                                                                    • memory/4564-290-0x00000000005E0000-0x0000000000A42000-memory.dmp
                                                                                                      Filesize

                                                                                                      4.4MB

                                                                                                      Download
                                                                                                    • memory/4564-195-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4564-281-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4564-287-0x00000000005E1000-0x0000000000622000-memory.dmp
                                                                                                      Filesize

                                                                                                      260KB

                                                                                                      Download
                                                                                                    • memory/4564-285-0x00000000005E1000-0x0000000000622000-memory.dmp
                                                                                                      Filesize

                                                                                                      260KB

                                                                                                      Download
                                                                                                    • memory/4696-209-0x00000000009A7000-0x0000000000A39000-memory.dmp
                                                                                                      Filesize

                                                                                                      584KB

                                                                                                      Download
                                                                                                    • memory/4696-189-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4740-323-0x0000000000400000-0x0000000000469000-memory.dmp
                                                                                                      Filesize

                                                                                                      420KB

                                                                                                      Download
                                                                                                    • memory/4740-322-0x0000000000798000-0x00000000007C7000-memory.dmp
                                                                                                      Filesize

                                                                                                      188KB

                                                                                                      Download
                                                                                                    • memory/4740-251-0x00000000005B0000-0x00000000005FB000-memory.dmp
                                                                                                      Filesize

                                                                                                      300KB

                                                                                                      Download
                                                                                                    • memory/4740-252-0x0000000000400000-0x0000000000469000-memory.dmp
                                                                                                      Filesize

                                                                                                      420KB

                                                                                                      Download
                                                                                                    • memory/4740-250-0x0000000000798000-0x00000000007C7000-memory.dmp
                                                                                                      Filesize

                                                                                                      188KB

                                                                                                      Download
                                                                                                    • memory/4740-237-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4904-162-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/4904-185-0x0000000000527000-0x0000000000537000-memory.dmp
                                                                                                      Filesize

                                                                                                      64KB

                                                                                                      Download
                                                                                                    • memory/4904-186-0x0000000000400000-0x000000000045E000-memory.dmp
                                                                                                      Filesize

                                                                                                      376KB

                                                                                                      Download
                                                                                                    • memory/4972-221-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/5008-388-0x0000000002E50000-0x0000000002F18000-memory.dmp
                                                                                                      Filesize

                                                                                                      800KB

                                                                                                      Download
                                                                                                    • memory/5008-383-0x0000000002D70000-0x0000000002E4C000-memory.dmp
                                                                                                      Filesize

                                                                                                      880KB

                                                                                                      Download
                                                                                                    • memory/5008-347-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/5040-375-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/5100-165-0x00000000006A3000-0x0000000000735000-memory.dmp
                                                                                                      Filesize

                                                                                                      584KB

                                                                                                      Download
                                                                                                    • memory/5100-167-0x0000000002230000-0x000000000234B000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.1MB

                                                                                                      Download
                                                                                                    • memory/5100-139-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/5248-426-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/5496-425-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/5684-410-0x0000000000000000-mapping.dmp
                                                                                                      Download
                                                                                                    • memory/5768-411-0x0000000000000000-mapping.dmp
                                                                                                      Download